4 ms·

Do you have a link for that discussion? I've been using Qubes for awhile now and the GUI has always been in DOM0 with no networking.

by jron 11y ago

nickpsecurity 11y ago
She censored my critiques from that point on. All I have is a cached copy of what I sent in response to her dismissing my comments on the mailing list. Fortunately, I often quote relevant points before countering them. You can easily see what each of us pushed. Her Mac OS X claim makes me laugh to this day. http://pastebin.com/b8Tz5jW1 http://pastebin.com/b8Tz5jW1 "and the GUI has always been in DOM0 with no networking." I'm clearly not a Qubes user. I'm basing my statement on what articles or comments here described as relatively recent work isolating the GUI stack further from attack. If that didn't happen, I retract it. The Xen, Dom0, and driver risks she ignored and countered directly so I was sure they'd be a problem. EDIT to add: Btw, she later did a one-side rebuttal countering various things here on her blog while censoring my rebuttal of course. One real problem she identified was my use of "military-grade:" commonly a buzzword indicating snake oil. I read lots of defense stuff back then but forgot to translate. I meant Type 1 certified by NSA for high-assurance use in military. It's a rigorous process identifying and often preventing... many issues people found in proprietary and FOSS products designed without high assurance practices. ;) So, I started saying NSA Type 1 certified from that point on to avoid confusion.
- jron 11y ago
  Thanks for taking the time to post that. Many of those statements are surprising given how well designed Qubes looks on the surface. I wish more people nitpicked projects like this. Please consider trying Qubes 3.1 out and posting a review. I'd love to read it.
  - nickpsecurity 11y ago
    I'm down to a few pieces of hardware and wary of doing anything heavyweight with them. I do want to try it out esp it's usability and such. What's resource usage like for it on single or dual core hardware?
    - jron 11y ago
      The minimum requirements are pretty low: https://www.qubes-os.org/doc/system-requirements/ https://www.qubes-os.org/doc/system-requirements/ I've only used it on mid-high end systems though. You should easily be able to launch a few small VMs (each AppVM is tunable) on a dual core machine with 4 GB of RAM though.

Do you have a link for that discussion? I've been using Qubes for awhile now and the GUI has always been in DOM0 with no networking.

by jron 11y ago

Do you have a link for that discussion? I've been using Qubes for awhile now and the GUI has always been in DOM0 with no networking.

nickpsecurity 11y ago

She censored my critiques from that point on. All I have is a cached copy of what I sent in response to her dismissing my comments on the mailing list. Fortunately, I often quote relevant points before countering them. You can easily see what each of us pushed. Her Mac OS X claim makes me laugh to this day. http://pastebin.com/b8Tz5jW1 http://pastebin.com/b8Tz5jW1 "and the GUI has always been in DOM0 with no networking." I'm clearly not a Qubes user. I'm basing my statement on what articles or comments here described as relatively recent work isolating the GUI stack further from attack. If that didn't happen, I retract it. The Xen, Dom0, and driver risks she ignored and countered directly so I was sure they'd be a problem. EDIT to add: Btw, she later did a one-side rebuttal countering various things here on her blog while censoring my rebuttal of course. One real problem she identified was my use of "military-grade:" commonly a buzzword indicating snake oil. I read lots of defense stuff back then but forgot to translate. I meant Type 1 certified by NSA for high-assurance use in military. It's a rigorous process identifying and often preventing... many issues people found in proprietary and FOSS products designed without high assurance practices. ;) So, I started saying NSA Type 1 certified from that point on to avoid confusion.

jron 11y ago
Thanks for taking the time to post that. Many of those statements are surprising given how well designed Qubes looks on the surface. I wish more people nitpicked projects like this. Please consider trying Qubes 3.1 out and posting a review. I'd love to read it.
- nickpsecurity 11y ago
  I'm down to a few pieces of hardware and wary of doing anything heavyweight with them. I do want to try it out esp it's usability and such. What's resource usage like for it on single or dual core hardware?
  - jron 11y ago
    The minimum requirements are pretty low: https://www.qubes-os.org/doc/system-requirements/ https://www.qubes-os.org/doc/system-requirements/ I've only used it on mid-high end systems though. You should easily be able to launch a few small VMs (each AppVM is tunable) on a dual core machine with 4 GB of RAM though.